Chargify is Secure Billing
Software

At Chargify, security is of paramount importance in every action and decision
we make. Remaining constantly vigilant, we continually improve and extend
the security of our application and the protection of the data entrusted to us.

Chargify is a PCI Service Provider Level 1

We are audited each year by a PCI-certified Qualified Security Assessor to ensure that we have established and maintain the appropriate security practices prescribed by the Payment Card Industry Data Security Standard for a service handling sensitive payment cardholder data.

Download Chargify's compliance validation.

Enforced standardized SSL encryption for all communication

We go to great lengths to keep your data safe and secure. You should never log in to Chargify over an unencrypted connection and you should never communicate with the Chargify application or API without using an HTTPS URL.

Persistent protection and safety scanning

We are continually evaluating our security and looking for ways to improve. We undertake the following tasks on a regular basis:

Scan both our internal and external networks to ensure that we have secured against known vulnerabilities.
Audit our codebase for possible security flaws.
Patch third-party software and services as vulnerabilities are found and fixed.
Subject our application to “penetration testing” by skilled and ethical “hackers.”

Full disclosure

If you believe you've discovered a potential flaw in any area of our security measures, we ask that you share the information with us first! When you report an issue to security@chargify.com, you can expect the following:

We’ll acknowledge your submission and provide ongoing updates as we investigate.
We may ask for more information or details about the behavior you expect or how you produced your results.
Once an issue has been addressed, we’ll notify you with the appropriate next steps.
Qualifying disclosures will make you eligible for our list of Whitehat Security Researchers.

We ask you to kindly retain secrecy of your findings until we have remediated the issue. Once the flaw has been fixed, you are free to disclose your results as you see fit.

Please note: We do not accept and will not respond to security reports related to our non-application marketing sites (e.g., chargify.com, www.chargify.com, status.chargify.com, docs.chargify.com, etc.). These sites do not have user information, login ability, or databases. Only disclosures for our database-backed Web application will receive a response.

PGP Key

We provide a PGP key to encrypt sensitive communication that you send to us:

Key ID: DC034200
Key type: RSA
Key size: 4096
User ID: security@chargify.com
Fingerprint: 4849 BC00 4F49 957E C4D0 82F2 05E9 F5E1 DC03 4200

Whitehat Hall of Fame

We maintain a list of all Whitehat Security Researchers who help us find a fix vulnerabilities. Special thanks goes out to all these researchers!

Chargify is Secure Billing Software